override-{a1,other,xd}: Regular batch of various overrides

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>

diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt
index d4f9c782c4df6b1597f4660092cb28ba3cfc4a97..96bfe45db4f384d965233705c919d8861ceaf07f 100644 (file)
--- a/overrides/override-a1.txt
+++ b/overrides/override-a1.txt
@@ -458,6 +458,11 @@ descr:                             Colorberry VPN Services
 remarks:                       VPN provider
 is-anonymous-proxy:            yes
 
+net:                           23.230.137.0/24
+descr:                         SSL Private Proxy
+remarks:                       VPN provider [high confidence, but not proofed]
+is-anonymous-proxy:            yes
+
 net:                           23.239.176.0/22
 descr:                         CloudVPN Inc.
 remarks:                       VPN provider

diff --git a/overrides/override-other.txt b/overrides/override-other.txt
index f60e652f896787666e5ef827217af073ad552b70..6cee3fe791e4a0f82a02cb975e22ac911fcb68ec 100644 (file)
--- a/overrides/override-other.txt
+++ b/overrides/override-other.txt
@@ -194,6 +194,11 @@ descr:             Nexril
 remarks:       ISP located in US, but some RIR data for announced prefixes contain garbage
 country:       US
 
+aut-num:       AS14237
+descr:         Beamspeed LLC
+remarks:       ISP located in US, but some RIR data for announced prefixes contain garbage
+country:       US
+
 aut-num:       AS15611
 descr:         Iranian Research Organization for Science & Technology
 remarks:       ISP located in IR, but some RIR data for announced prefixes contain garbage
@@ -308,6 +313,11 @@ descr:             Leaseweb Deutschland GmbH
 remarks:       ISP located in Frankfurt/Main, DE, but many RIR data for announced prefixes contain garbage
 country:       DE
 
+aut-num:       AS29119
+descr:         AireNetworks
+remarks:       ISP located in ES, but some RIR data for announced prefixes contain garbage (BZ)
+country:       ES
+
 aut-num:       AS29405
 descr:         ABGON Comunicaciones
 remarks:       ISP located in SK, but some RIR data for announced prefixes contain garbage (BZ)
@@ -558,6 +568,11 @@ descr:             Digitale Suisse AG
 remarks:       ISP located in CH, but some RIR data for announced prefixes contain garbage
 country:       CH
 
+aut-num:       AS43606
+descr:         Korkem Technologies LLP
+remarks:       ISP located in KZ, but some RIR data for announced prefixes contain garbage
+country:       KZ
+
 aut-num:       AS43624
 descr:         PQ HOSTING S.R.L.
 remarks:       tampers with RIR data sometimes, traces back to NL
@@ -593,6 +608,11 @@ descr:             Skylink Data Center BV
 remarks:       ISP located in NL, but some RIR data for announced prefixes contain garbage
 country:       NL
 
+aut-num:       AS44735
+descr:         Nova hf
+remarks:       ISP located in IS, but some RIR data for announced prefixes contain garbage
+country:       IS
+
 aut-num:       AS44889
 descr:         Farhang Azma Communications Company LTD
 remarks:       ... contains traces of bogus RIR data
@@ -643,6 +663,11 @@ descr:             NEROCLOUD Ltd.
 remarks:       RIR data faked/incorrect, cannot trust this network
 country:       EU
 
+aut-num:       AS48031
+descr:         PE Ivanov Vitaliy Sergeevich
+remarks:       ISP located in UA, but some RIR data for announced prefixes contain garbage
+country:       UA
+
 aut-num:       AS48158
 descr:         DigitalOne AG
 remarks:       Services appear to be hosted in RU, RIR data faked/incorrect
@@ -778,6 +803,11 @@ descr:             Hostkey B.V.
 remarks:       ISP located in NL, but some RIR data for announced prefixes contain garbage
 country:       NL
 
+aut-num:       AS57335
+descr:         AAGlenn Internetworking Compan
+remarks:       all prefixes announced by this AS are assigned to DE, but traceroutes all dead-end in NL
+country:       NL
+
 aut-num:       AS57416
 descr:         LLC South Internet
 remarks:       ISP located in RU, but many RIR data for announced prefixes contain garbage
@@ -808,6 +838,11 @@ descr:             ULTRANEX LTD
 remarks:       fake offshore location (CY), hosted in NL
 country:       NL
 
+aut-num:       AS58202
+descr:         Navitgo LLC
+remarks:       ISP and IP hijacker located in BR, but some RIR data for announced prefixes contain garbage
+country:       BR
+
 aut-num:       AS58224
 descr:         Iran Telecommunication Company PJS
 remarks:       ... located in IR
@@ -878,11 +913,21 @@ descr:            DignusData LLC
 remarks:       ISP located in PL, but _all_ RIR data for announced prefixes contain garbage
 country:       PL
 
+aut-num:       AS60458
+descr:         Xtudio Networks S.L.U.
+remarks:       ISP and IP hijacker located in ES
+country:       ES
+
 aut-num:       AS60546
 descr:         EU Routing Ltd
 remarks:       fake offshore location (CY), hosted in NL
 country:       NL
 
+aut-num:       AS60567
+descr:         DataClub S.A.
+remarks:       location pinning to SE
+country:       SE
+
 aut-num:       AS60721
 descr:         Bursabil Teknoloji A.S.
 remarks:       ISP located in TR, but many RIR data for announced prefixes contain garbage
@@ -1178,6 +1223,11 @@ descr:           FLP Kochenov Aleksej Vladislavovich
 remarks:       ISP located in UA, but RIR data for announced prefixes all say EU
 country:       UA
 
+aut-num:       AS197040
+descr:         LLC MillerSoft / DataArt_Technologies UK Ltd / whatever
+remarks:       tampers with RIR data, located in RU
+country:       RU
+
 aut-num:       AS197071
 descr:         active 1 GmbH
 remarks:       ISP located in DE, some RIR data for announced prefixes contain garbage
@@ -1213,6 +1263,11 @@ descr:           bet-at-home.com International Ltd.
 remarks:       ... traces back to AT
 country:       AT
 
+aut-num:       AS201452
+descr:         JOINT-STOCK COMPANY "SOVCOMBANK LIFE"
+remarks:       ISP located in RU, but some RIR data for announced prefixes contain garbage
+country:       RU
+
 aut-num:       AS201702
 descr:         skHosting.eu s.r.o.
 remarks:       ISP located in SK, but some RIR data for announced prefixes contain garbage
@@ -1413,11 +1468,6 @@ descr:           MurVal LTD.
 remarks:       ... all traceroutes observed so far dead-end in BG
 country:       BG
 
-aut-num:       AS209654
-descr:         Delis LLC
-remarks:       Shary Serverion customer in NL, many RIR data for announced prefixes contain garbage
-country:       NL
-
 aut-num:       AS210119
 descr:         VPSSC Networks LTD
 remarks:       ISP located in UA, but RIR data for announced prefixes contain garbage
@@ -1718,6 +1768,11 @@ descr:           US AFG 20200130
 remarks:       claims to be located in US, but traces back to SK
 country:       SK
 
+net:           45.151.68.0/22
+descr:         Natalia Sokolova
+remarks:       appears to tamper with RIR data, location pinning to RU for good measure
+country:       RU
+
 net:           45.155.121.0/24
 descr:         Itace International Limited
 remarks:       claims to be located in HK, but traces back to RO

diff --git a/overrides/override-xd.txt b/overrides/override-xd.txt
index c8ea8955cd886eeb29429387927d0d521c51d024..feb9745eccd522962be4aa7740440d53374adb6c 100644 (file)
--- a/overrides/override-xd.txt
+++ b/overrides/override-xd.txt
@@ -337,6 +337,12 @@ remarks:   bulletproof ISP operating from a war zone in eastern UA
 country:       UA
 drop:          yes
 
+aut-num:       AS209654
+descr:         Delis LLC
+remarks:       Shary Serverion customer and IP hijacker in NL, many RIR data for announced prefixes contain garbage
+country:       NL
+drop:          yes
+
 aut-num:       AS210848
 descr:         Telkom Internet LTD
 remarks:       Rogue ISP (linked to AS202425) located in NL
@@ -367,6 +373,12 @@ remarks:   Dirty ISP located somewhere in EU, cannot trust RIR data of this networ
 country:       EU
 drop:          yes
 
+aut-num:       AS212738
+descr:         LUSOVPS UNIPESSOAL LDA
+remarks:       IP hijacker located in PT
+country:       PT
+drop:          yes
+
 aut-num:       AS213058
 descr:         Private Internet Hosting LTD
 remarks:       bulletproof ISP located in RU
@@ -379,6 +391,12 @@ remarks:   Hijacked AS being announced out of RU
 country:       RU
 drop:          yes
 
+aut-num:       AS327790
+descr:         Wirels Connect (PTY) Ltd
+remarks:       Hijacked AS being announced out of PT
+country:       PT
+drop:          yes
+
 aut-num:       AS328543
 descr:         Sun Network Company Limited
 remarks:       IP hijacker, traces back to AP region
@@ -414,6 +432,16 @@ remarks:   ISP located in KR, tampers with RIR data
 country:       KR
 drop:          yes
 
+net:           154.73.248.0/22
+descr:         Wirels Connect (PTY) Ltd
+remarks:       Most likely stolen AfriNIC IPv4 space
+drop:          yes
+
+net:           161.123.0.0/16
+descr:         Wirels Connect (PTY) Ltd
+remarks:       Most likely stolen AfriNIC IPv4 space, already SBL'ed (SBL547511), not a safe area to accept traffic from
+drop:          yes
+
 net:           195.133.20.0/24
 descr:         Tribeka Web Advisors S.A.
 remarks:       Tampers with RIR data, traces back to NL, not a safe place to route traffic to